diff -r --context /usr/src.original/sys/fs/unionfs/union_subr.c /usr/src.modified/sys/fs/unionfs/union_subr.c
*** /usr/src.original/sys/fs/unionfs/union_subr.c	2016-03-25 10:09:43.000000000 +0900
--- /usr/src.modified/sys/fs/unionfs/union_subr.c	2016-11-08 23:14:26.288061000 +0900
***************
*** 219,240 ****
  
  	ump = MOUNTTOUNIONFSMOUNT(mp);
  	lkflags = (cnp ? cnp->cn_lkflags : 0);
- 	path = (cnp ? cnp->cn_nameptr : NULL);
  	*vpp = NULLVP;
  
  	if (uppervp == NULLVP && lowervp == NULLVP)
  		panic("unionfs_nodeget: upper and lower is null");
  
  	vt = (uppervp != NULLVP ? uppervp->v_type : lowervp->v_type);
  
- 	/* If it has no ISLASTCN flag, path check is skipped. */
- 	if (cnp && !(cnp->cn_flags & ISLASTCN))
- 		path = NULL;
- 
  	/* check the cache */
  	if (path != NULL && dvp != NULLVP && vt == VDIR) {
  		vp = unionfs_get_cached_vnode(uppervp, lowervp, dvp, path);
  		if (vp != NULLVP) {
  			vref(vp);
  			*vpp = vp;
  			goto unionfs_nodeget_out;
--- 219,245 ----
  
  	ump = MOUNTTOUNIONFSMOUNT(mp);
  	lkflags = (cnp ? cnp->cn_lkflags : 0);
  	*vpp = NULLVP;
  
+ 	if (cnp && cnp->cn_nameptr) {
+ 		path = (char *)
+ 		    malloc(cnp->cn_namelen +1, M_UNIONFSPATH, M_WAITOK|M_ZERO);
+ 		bcopy(cnp->cn_nameptr, path, cnp->cn_namelen);
+ 		path[cnp->cn_namelen] = '\0';
+ 	} else {
+ 		path = NULL;
+ 	}
+ 
  	if (uppervp == NULLVP && lowervp == NULLVP)
  		panic("unionfs_nodeget: upper and lower is null");
  
  	vt = (uppervp != NULLVP ? uppervp->v_type : lowervp->v_type);
  
  	/* check the cache */
  	if (path != NULL && dvp != NULLVP && vt == VDIR) {
  		vp = unionfs_get_cached_vnode(uppervp, lowervp, dvp, path);
  		if (vp != NULLVP) {
+ 			free(path, M_UNIONFSPATH);
  			vref(vp);
  			*vpp = vp;
  			goto unionfs_nodeget_out;
***************
*** 252,262 ****
--- 257,269 ----
  
  	error = getnewvnode("unionfs", mp, &unionfs_vnodeops, &vp);
  	if (error != 0) {
+ 		free(path, M_UNIONFSPATH);
  		free(unp, M_UNIONFSNODE);
  		return (error);
  	}
  	error = insmntque(vp, mp);	/* XXX: Too early for mpsafe fs */
  	if (error != 0) {
+ 		free(path, M_UNIONFSPATH);
  		free(unp, M_UNIONFSNODE);
  		return (error);
  	}
***************
*** 281,290 ****
  		vp->v_vnlock = lowervp->v_vnlock;
  
  	if (path != NULL) {
! 		unp->un_path = (char *)
! 		    malloc(cnp->cn_namelen +1, M_UNIONFSPATH, M_WAITOK|M_ZERO);
! 		bcopy(cnp->cn_nameptr, unp->un_path, cnp->cn_namelen);
! 		unp->un_path[cnp->cn_namelen] = '\0';
  	}
  	vp->v_type = vt;
  	vp->v_data = unp;
--- 288,294 ----
  		vp->v_vnlock = lowervp->v_vnlock;
  
  	if (path != NULL) {
! 		unp->un_path = path;
  	}
  	vp->v_type = vt;
  	vp->v_data = unp;